IT Risk Assessment · NV-RA-0000 · Rev A

What you are actually running.

An inventory of the accounts, devices, data and defences this business depends on, with every gap we found written down in plain language — whether or not you do anything about it with us.

Sample document. Findings below are composites, drawn from real Dallas–Fort Worth engagements and anonymised. A live assessment carries the client's own name, counts and evidence.

Prepared for
Northgate Supply Co.
Sector
Distribution
People
21
Devices seen
27
Sites
1
Fieldwork
3 days on site
Issued
12 Oct 2026
Summary

Sixteen findings. Five of them need attention this month.

Nothing here is on fire. That is normal, and it is also the point — the items that cost a business this size money are usually the ones that never generate a support ticket.

5Critical — act within 30 days
8Important — plan within 90 days
3Healthy — no action needed
$4,180Annual recoverable spend, from your own invoices
Identity & access
Critical
Six accounts belong to people who have left. Multi-factor is licensed but off for nine users.
Administrative access
Critical
No break-glass account exists. Three people hold global administrator on the account they use for daily email.
Conditional access
Important
No policies configured. A correct password grants access from any device, any country, at any hour.
Backup & recovery
Critical
Files are backed up. Email, OneDrive and SharePoint are not. No restore has ever been tested.
Email security
Critical
DMARC is absent. Anyone can send mail that appears to come from your domain.
Server & core services
Critical
One machine runs directory, file storage and accounting. It is seven years old and out of warranty.
Licensing & spend
Important
Thirty-one licences billed against twenty-one people. Eleven are shared addresses, not staff.
Endpoints
Important
Four machines are on an operating system past end of support. Disk encryption is off on eleven.
Network & perimeter
Important
Firewall firmware is three years old. Guest wireless shares the network with company systems.
Documentation & continuity
Important
Administrative credentials are held by one person. No written record of what runs where.
Endpoint protection
Healthy
Present, current and reporting on every machine we could see.
Connectivity
Healthy
Symmetric fibre with adequate headroom for the current headcount.
Findings

The five that matter first.

Each one states what we observed, why it costs something, and what closing it involves. The remaining eleven are listed in the appendix of the live document.

Six active accounts belong to former employees

Critical F-01
What we found
Six user accounts are enabled and licensed for people no longer employed here. The oldest last signed in twenty-two months ago. None has multi-factor authentication enabled.
Why it matters
Each one is a working set of credentials to your email, files and finance systems, held by someone who does not work for you, with no second factor in the way. Nobody is monitoring them because nobody remembers they exist.
What closing it takes
Confirm each departure with you, convert mailboxes that still receive business mail to shared mailboxes, archive the data, then disable and unlicense. About half a day, and it reduces the monthly bill rather than adding to it.

Email, OneDrive and SharePoint are not backed up

Critical F-02
What we found
Workstation and server backups run nightly and look healthy. Microsoft 365 data has no backup at all. No restore has been tested at any point.
Why it matters
Microsoft guarantees the service, not your content. A deleted mailbox, a compromised account that empties a folder, or a departing employee who clears their drive leaves you inside a retention window measured in days. A backup nobody has restored from is a theory.
What closing it takes
Microsoft 365 backup covering mail, OneDrive and SharePoint, plus one documented test restore. Included in managed service at no separate charge.

Your domain has no DMARC policy

Critical F-03
What we found
SPF is published but ends in a soft fail. DKIM is not signing. No DMARC record exists. This is visible publicly, from outside your network, to anyone who looks.
Why it matters
Without DMARC, anyone can send email that appears to come from your domain, and receiving mail servers have no instruction to stop it. The usual version is an invoice with changed bank details, sent to your customers, in your name. The damage lands on your relationships rather than your network.
What closing it takes
Inventory every legitimate sender, correct SPF, enable DKIM signing, publish DMARC in monitoring mode, then move to enforcement once reports are clean. Four to six weeks, most of it waiting on reports rather than working.

One server is doing three jobs, out of warranty

Critical F-04
What we found
A single physical server provides directory services, the company file share and the accounting database. It is seven years old, out of manufacturer warranty, and has one disk reporting degraded health.
Why it matters
Three dependencies on one box means one failure stops everyone working, not one function. Out of warranty, the replacement clock starts when it fails rather than when you choose. The usual path is an emergency purchase at a bad price under time pressure.
What closing it takes
In most businesses this size the answer is not a replacement server. Directory moves to Microsoft 365, files move to SharePoint, and only the accounting workload needs somewhere to live — which is usually smaller and cheaper than the box it came off. We scope it against your actual data before recommending anything.

There is no way back into the tenant if administrator access is lost

Critical F-05
What we found
No break-glass account exists. Global administrator sits on three accounts that are also used for daily email, each tied to one person's phone for multi-factor. There are no conditional access policies, so a correct password alone is sufficient from any device, in any country, at any hour.
Why it matters
These two findings pull against each other, which is why they belong together. Switching conditional access on without an emergency account is how a business locks itself out of its own tenant — a policy misconfiguration, a lost phone or a departing administrator, and nobody can get back in. Leaving both as they are means access depends on a password and the goodwill of three individuals.
What closing it takes
Two cloud-only break-glass accounts first, excluded from conditional access, with long credentials stored offline and sign-in alerting on both. Then separate administrator identities from daily accounts, and only then roll conditional access out in report-only mode before enforcing. The order is the whole job; done the other way round it causes the outage it is meant to prevent.
Recommended sequence

What we would do, and in what order.

Ordered by exposure removed per hour spent, not by what is most interesting to work on.

First 30 days

  • Close the six former-employee accounts and convert the mailboxes still in use
  • Create two break-glass administrator accounts, excluded from policy, credentials offline
  • Enforce multi-factor authentication across all accounts, administrators first
  • Separate administrator identities from the accounts those people use for daily email
  • Turn on Microsoft 365 backup and perform one documented test restore
  • Publish DMARC in monitoring mode and begin collecting reports

Days 30 to 90

  • Conditional access in report-only mode, then enforced once the reports are clean
  • Right-size licensing: eleven shared addresses move off billed user seats
  • Replace the four end-of-support machines and enable disk encryption fleet-wide
  • Separate guest wireless from company systems and update firewall firmware
  • Scope the server workloads properly and agree a path before anything fails

Ongoing

  • Move DMARC from monitoring to enforcement once sender reports are clean
  • Document what runs where, and place administrative credentials somewhere recoverable
  • Quarterly review of accounts, licences and backup restores against this document
Scope

How this was done, and what we did not look at.

The assessment ran over five business days: three on site, two spent reconciling what we found and producing this document. It covered identity, administrative access, conditional access, licensing, endpoints, backup, email security, network perimeter and documentation.

Three things were needed to do it: a read-only account on the Microsoft 365 tenant, time on a workstation on site with the assigned user signed in as themselves, and your current software and telecoms invoices. The invoices are what make the recoverable-spend figure on the first page a calculation rather than an estimate.

No administrative credentials were requested, no software was installed, and no configuration was changed at any point. A findings document is only useful if it is honest about its edges, so here are ours.

Where something fell outside scope and looked worth attention anyway, it is noted in the findings rather than left out.

Next step

This document is yours either way.

We will walk through it on a call, answer whatever you want to push on, and leave you with the written version. If you take the list to your current provider or handle it internally, that is a reasonable outcome and the assessment has done its job.

If you would rather it stopped being your problem, that conversation is a separate one and we are happy to have it after this.

Novvative Dallas–Fort Worth, Texas +1 469-830-2877 novvative.com